Last updated: 24 September 2026

HAMPADAMA respects your privacy. This page explains what information we collect, why, and the choices you have. We handle personal data in accordance with Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended.

What we collect

• Orders: your name, email, phone number, delivery address, city, any notes you add, and what you ordered.
• Accounts: your name, email, phone and address if you create an account. Your password is stored only as a secure one-way hash (BCrypt) — nobody, including us, can read it.
• Messages & reviews: what you send through the contact form or WhatsApp, and reviews (and any photo) you submit.
• Newsletter: your email address, if you join.
• Technical: basic server logs (such as IP address and browser type) used to keep the site secure and stop spam.

How we use it

• To process, confirm and deliver your orders, and to contact you about them (by email, phone or WhatsApp).
• To answer your messages and provide customer support.
• To send the newsletter, only if you've signed up. Every newsletter has a one-click unsubscribe link.
• To protect the website and our customers from fraud and abuse.

Who we share it with

We never sell your data. We only share what's needed with:

• our courier — your name, phone and delivery address, so they can deliver your parcel;
• our email provider, which sends order and account emails for us;
• our website hosting provider, which stores the website and its database securely;
• authorities, only if the law requires it.

Cookies & browser storage

• A session cookie keeps you logged in and protects forms from misuse. It's deleted when you close your browser or log out.
• If you tick Keep me logged in, a remember-me cookie keeps you logged in on that device for up to 30 days.
• If you shop without logging in, your cart is saved in your own browser (not on our servers) until you order.

How long we keep it

We keep order records for as long as needed for accounting purposes (normally up to 6 years). Account details are kept until you ask us to delete your account. Contact messages are kept while they're useful for helping you, and newsletter emails until you unsubscribe.

Keeping it safe

The website uses encrypted connections (HTTPS), passwords are hashed, access to order data is limited to our team, and order pages can only be opened by you (with your login or the private link we email you).

Your rights

You can ask to see the personal data we hold about you, correct it, or have it deleted (except where we must keep order records by law). You can update most details yourself in My Account. For anything else, email [email protected] and we'll respond within 30 days.

Children

Our website isn't intended for children under 16, and we don't knowingly collect their data.

Changes

If we change this policy, we'll update the date at the top of this page.